Initial cluster config: NixOS flake + k3s + 5 node definitions

- Multi-host flake.nix (3x N97 x86_64 + 2x RPi4 aarch64)
- Shared modules: k3s-cluster, tailscale, meos-gateway
- Node configs: n97-1 (control plane), n97-2/n97-3 (Ollama workers), rpi4-1/rpi4-2 (ARM workers)
- K8s manifests: Forgejo, Postgres (CNPG), Umami, OpenBrain, MeOS Dashboard, MCP servers
- Bootstrap and DB migration scripts
- Migration plan doc (7-day phased rollout)

nodes/n97-3.nix

@@ -0,0 +1,42 @@
+{ config, lib, pkgs, ... }:
+
+let
+  tailscaleIP = "100.x.x.x";
+in {
+  networking.hostName = "n97-3";
+
+  services.k3s-cluster = {
+    enable = true;
+    role = "agent";
+    serverAddr = "https://100.x.x.x:6443";  # n97-1 IP
+    tailscaleIP = tailscaleIP;
+    tokenFile = "/var/lib/k3s/cluster-token";
+    withOllama = true;
+  };
+
+  services.ollama.models = [
+    "qwen3-coder-next:cloud"  # targeted code
+    "deepseek-v4-flash:cloud"  # fast default
+    "nomic-embed-text"        # embeddings
+    "mxbai-embed-large"       # embeddings
+  ];
+
+  networking.firewall = {
+    enable = true;
+    trustedInterfaces = [ "tailscale0" ];
+    allowedTCPPorts = [ 11434 ];
+  };
+
+  users.users.sscoble = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+  };
+
+  security.sudo.extraRules = [{
+    users = [ "sscoble" ];
+    commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
+  }];
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.trusted-users = [ "sscoble" ];
+}